[RELIABILITY] Unbounded Temporary File Creation in website_handlers #22

New issue

Open

opened 2026-02-14 21:25:05 +00:00 by thabeta · 0 comments

thabeta commented

2026-02-14 21:25:05 +00:00

Owner

The get_file_from_flist function in website_handlers.rs (Lines 26-29) creates a new tempfile::NamedTempFile and writes the entire flist content to it on every single file request.

Risk: This is a massive I/O bottleneck and a potential Denial of Service (DoS) vector. A high volume of requests will saturate disk I/O and could fill up the /tmp partition because files are written and opened repeatedly.

Fix: Implement a cache for "opened" flist databases or use an in-memory SQLite implementation if the flists are small enough.

The `get_file_from_flist` function in `website_handlers.rs` (Lines 26-29) creates a new `tempfile::NamedTempFile` and writes the entire flist content to it on every single file request. **Risk:** This is a massive I/O bottleneck and a potential Denial of Service (DoS) vector. A high volume of requests will saturate disk I/O and could fill up the `/tmp` partition because files are written and opened repeatedly. **Fix:** Implement a cache for "opened" flist databases or use an in-memory SQLite implementation if the flists are small enough.